[pull] master from php:master

.github/workflows/docs.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'php/php-src'
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Install dependencies
         run: pip install -r docs/requirements.txt
       - name: Check formatting

.github/workflows/nightly.yml

@@ -54,7 +54,7 @@ jobs:
     runs-on: [self-hosted, gentoo, ppc64]
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: System info
@@ -95,7 +95,7 @@ jobs:
       image: 'alpine:3.20.1'
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: apk
@@ -206,7 +206,7 @@ jobs:
     runs-on: ubuntu-${{ matrix.asan && inputs.asan_ubuntu_version || inputs.ubuntu_version }}
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: Create MSSQL container
@@ -306,7 +306,7 @@ jobs:
           FIREBIRD_PASSWORD: test
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: apt
@@ -374,7 +374,7 @@ jobs:
     runs-on: macos-${{ matrix.os }}
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: brew
@@ -449,7 +449,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: Create MSSQL container
@@ -502,7 +502,7 @@ jobs:
       USE_TRACKED_ALLOC: 1
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: apt
@@ -705,7 +705,7 @@ jobs:
     runs-on: ubuntu-${{ inputs.ubuntu_version }}
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: Create MSSQL container
@@ -768,7 +768,7 @@ jobs:
     runs-on: ubuntu-${{ inputs.ubuntu_version }}
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: apt
@@ -859,7 +859,7 @@ jobs:
     runs-on: ubuntu-${{ inputs.ubuntu_version }}
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: apt
@@ -909,38 +909,38 @@ jobs:
       CXX: ccache g++
     steps:
       - name: git checkout PHP
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: php
           ref: ${{ inputs.branch }}
       - name: git checkout apcu
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: krakjoe/apcu
           path: apcu
       - name: git checkout imagick
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: Imagick/imagick
           path: imagick
       - name: git checkout memcached
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: php-memcached-dev/php-memcached
           path: memcached
       - name: git checkout redis
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: phpredis/phpredis
           path: redis
       - name: git checkout xdebug
         if: false
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: xdebug/xdebug
           path: xdebug
       - name: git checkout yaml
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: php/pecl-file_formats-yaml
           path: yaml
@@ -1050,7 +1050,7 @@ jobs:
       - name: git config
         run: git config --global core.autocrlf false && git config --global core.eol lf
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: Setup
@@ -1071,7 +1071,7 @@ jobs:
     timeout-minutes: 50
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch }}
       - name: FreeBSD

.github/workflows/push.yml

@@ -82,7 +82,7 @@ jobs:
     timeout-minutes: 50
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: apt
         uses: ./.github/actions/apt-x64
       - name: System info
@@ -166,7 +166,7 @@ jobs:
           FIREBIRD_PASSWORD: test
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: apt
         uses: ./.github/actions/apt-x32
       - name: ccache
@@ -203,7 +203,7 @@ jobs:
     timeout-minutes: 50
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: brew
         uses: ./.github/actions/brew
       - name: ccache
@@ -250,7 +250,7 @@ jobs:
       - name: git config
         run: git config --global core.autocrlf false && git config --global core.eol lf
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Setup
         uses: ./.github/actions/setup-windows
       - name: Build
@@ -264,7 +264,7 @@ jobs:
     timeout-minutes: 50
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       # ASLR can cause a lot of noise due to missed sse opportunities for memcpy
@@ -326,7 +326,7 @@ jobs:
           mysql -uroot -proot -e "CREATE USER 'wordpress'@'localhost' IDENTIFIED BY 'wordpress'; FLUSH PRIVILEGES;"
           mysql -uroot -proot -e "GRANT ALL PRIVILEGES ON *.* TO 'wordpress'@'localhost' WITH GRANT OPTION;"
       - name: git checkout benchmarking-data
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: php/benchmarking-data
           ssh-key: ${{ secrets.BENCHMARKING_DATA_DEPLOY_KEY }}
@@ -369,6 +369,6 @@ jobs:
     timeout-minutes: 50
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: FreeBSD
         uses: ./.github/actions/freebsd

.github/workflows/real-time-benchmark.yml

@@ -103,21 +103,21 @@ jobs:
           sudo apt-get update -y
           sudo apt-get install -y terraform=1.5.7-*
       - name: Checkout benchmark suite
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: 'kocsismate/php-version-benchmarks'
           ref: 'main'
           fetch-depth: 1
           path: 'php-version-benchmarks'
       - name: Checkout php-src (benchmarked version)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: '${{ env.REPOSITORY }}'
           ref: '${{ env.COMMIT }}'
           fetch-depth: 100
           path: 'php-version-benchmarks/tmp/php_${{ env.ID }}'
       - name: Checkout php-src (baseline version)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: '${{ env.REPOSITORY }}'
           ref: '${{ env.BASELINE_COMMIT }}'
@@ -131,7 +131,7 @@ jobs:
           rm -rf ./php-version-benchmarks/docs/results
       - name: Checkout benchmark data
         if: github.event_name != 'workflow_dispatch'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: php/real-time-benchmark-data
           ssh-key: ${{ secrets.PHP_VERSION_BENCHMARK_RESULTS_DEPLOY_KEY }}

.github/workflows/root.yml

@@ -13,7 +13,7 @@ jobs:
     outputs:
       branches: ${{ steps.set-matrix.outputs.branches }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           # Set fetch-depth to 0 to clone the full repository
           # including all branches. This is required to find

NEWS

@@ -9,6 +9,9 @@ PHP                                                                        NEWS
   . Implement #81724 (openssl_cms_encrypt only allows specific ciphers).
     (Jakub Zelenka)
 
+- Standard:
+  . Fixed bug GH-16649 (UAF during array_splice). (alexandre-daubois)
+
 14 Aug 2025, PHP 8.5.0beta1
 
 - Core:

UPGRADING.INTERNALS

@@ -79,6 +79,7 @@ PHP 8.5 INTERNALS UPGRADE NOTES
     delayed. Before, errors would be recorded but not delayed.
   . zend_mm_refresh_key_child() must be called on any zend_mm_heap inherited
     from the parent process after a fork().
+  . HASH_KEY_IS_* constants have been moved in the zend_hash_key_type enum.
 
 - standard
   . ext/standard/php_smart_string.h and ext/standard/php_smart_string_public.h

Zend/zend_hash.c

@@ -2842,7 +2842,7 @@ ZEND_API zend_result ZEND_FASTCALL zend_hash_move_backwards_ex(const HashTable *
 
 
 /* This function should be made binary safe  */
-ZEND_API int ZEND_FASTCALL zend_hash_get_current_key_ex(const HashTable *ht, zend_string **str_index, zend_ulong *num_index, const HashPosition *pos)
+ZEND_API zend_hash_key_type ZEND_FASTCALL zend_hash_get_current_key_ex(const HashTable *ht, zend_string **str_index, zend_ulong *num_index, const HashPosition *pos)
 {
 	uint32_t idx;
 	Bucket *p;
@@ -2889,7 +2889,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_get_current_key_zval_ex(const HashTable *h
 	}
 }
 
-ZEND_API int ZEND_FASTCALL zend_hash_get_current_key_type_ex(const HashTable *ht, const HashPosition *pos)
+ZEND_API zend_hash_key_type ZEND_FASTCALL zend_hash_get_current_key_type_ex(const HashTable *ht, const HashPosition *pos)
 {
 	uint32_t idx;
 	Bucket *p;

Zend/zend_hash.h

@@ -26,9 +26,11 @@
 #include "zend_string.h"
 #include "zend_sort.h"
 
-#define HASH_KEY_IS_STRING 1
-#define HASH_KEY_IS_LONG 2
-#define HASH_KEY_NON_EXISTENT 3
+typedef enum {
+	HASH_KEY_IS_STRING = 1,
+	HASH_KEY_IS_LONG,
+	HASH_KEY_NON_EXISTENT
+} zend_hash_key_type;
 
 #define HASH_UPDATE 			(1<<0) /* Create new entry, or update the existing one. */
 #define HASH_ADD				(1<<1) /* Create new entry, or fail if it exists. */
@@ -251,9 +253,9 @@ ZEND_API HashPosition ZEND_FASTCALL zend_hash_get_current_pos(const HashTable *h
 
 ZEND_API zend_result   ZEND_FASTCALL zend_hash_move_forward_ex(const HashTable *ht, HashPosition *pos);
 ZEND_API zend_result   ZEND_FASTCALL zend_hash_move_backwards_ex(const HashTable *ht, HashPosition *pos);
-ZEND_API int   ZEND_FASTCALL zend_hash_get_current_key_ex(const HashTable *ht, zend_string **str_index, zend_ulong *num_index, const HashPosition *pos);
+ZEND_API zend_hash_key_type  ZEND_FASTCALL zend_hash_get_current_key_ex(const HashTable *ht, zend_string **str_index, zend_ulong *num_index, const HashPosition *pos);
 ZEND_API void  ZEND_FASTCALL zend_hash_get_current_key_zval_ex(const HashTable *ht, zval *key, const HashPosition *pos);
-ZEND_API int   ZEND_FASTCALL zend_hash_get_current_key_type_ex(const HashTable *ht, const HashPosition *pos);
+ZEND_API zend_hash_key_type ZEND_FASTCALL zend_hash_get_current_key_type_ex(const HashTable *ht, const HashPosition *pos);
 ZEND_API zval* ZEND_FASTCALL zend_hash_get_current_data_ex(const HashTable *ht, const HashPosition *pos);
 ZEND_API void  ZEND_FASTCALL zend_hash_internal_pointer_reset_ex(const HashTable *ht, HashPosition *pos);
 ZEND_API void  ZEND_FASTCALL zend_hash_internal_pointer_end_ex(const HashTable *ht, HashPosition *pos);
@@ -270,13 +272,13 @@ static zend_always_inline zend_result zend_hash_move_forward(HashTable *ht) {
 static zend_always_inline zend_result zend_hash_move_backwards(HashTable *ht) {
 	return zend_hash_move_backwards_ex(ht, &ht->nInternalPointer);
 }
-static zend_always_inline int zend_hash_get_current_key(const HashTable *ht, zend_string **str_index, zend_ulong *num_index) {
+static zend_always_inline zend_hash_key_type zend_hash_get_current_key(const HashTable *ht, zend_string **str_index, zend_ulong *num_index) {
 	return zend_hash_get_current_key_ex(ht, str_index, num_index, &ht->nInternalPointer);
 }
 static zend_always_inline void zend_hash_get_current_key_zval(const HashTable *ht, zval *key) {
 	zend_hash_get_current_key_zval_ex(ht, key, &ht->nInternalPointer);
 }
-static zend_always_inline int zend_hash_get_current_key_type(const HashTable *ht) {
+static zend_always_inline zend_hash_key_type zend_hash_get_current_key_type(const HashTable *ht) {
 	return zend_hash_get_current_key_type_ex(ht, &ht->nInternalPointer);
 }
 static zend_always_inline zval* zend_hash_get_current_data(const HashTable *ht) {

Zend/zend_weakrefs.c

@@ -648,7 +648,7 @@ static void zend_weakmap_iterator_get_current_key(zend_object_iterator *obj_iter
 
 	zend_string *string_key;
 	zend_ulong num_key;
-	int key_type = zend_hash_get_current_key_ex(&wm->ht, &string_key, &num_key, pos);
+	zend_hash_key_type key_type = zend_hash_get_current_key_ex(&wm->ht, &string_key, &num_key, pos);
 	if (key_type == HASH_KEY_NON_EXISTENT) {
 		ZVAL_NULL(key);
 		return;

ext/com_dotnet/com_variant.c

@@ -32,7 +32,7 @@ static void safe_array_from_zval(VARIANT *v, zval *z, int codepage)
 	SAFEARRAY *sa = NULL;
 	SAFEARRAYBOUND bound;
 	HashPosition pos;
-	int keytype;
+	zend_hash_key_type keytype;
 	zend_string *strindex;
 	zend_ulong intindex = 0;
 	VARIANT *va;

ext/com_dotnet/com_wrapper.c

@@ -423,7 +423,7 @@ static void generate_dispids(php_dispatchex *disp)
 	HashPosition pos;
 	zend_string *name = NULL;
 	zval *tmp, tmp2;
-	int keytype;
+	zend_hash_key_type keytype;
 	zend_long pid;
 
 	if (disp->dispid_to_name == NULL) {